Re: [PATCH v2] mm/migrate_device: Clear stale mapping after freeing swapcache

[David Hildenbrand (Arm)]

On 7/25/26 06:43, Andrew Morton wrote:
> On Fri, 24 Jul 2026 13:57:02 +0530 Arvind Yadav <arvind.yadav@xxxxxxxxx> wrote:
> 
>> __migrate_device_pages() reads the folio mapping before calling
>> folio_free_swap(). When folio_free_swap() succeeds, the folio is removed
>> from the swap cache, but the saved mapping still points to swap_space.
>>
>> Passing the stale mapping to folio_migrate_mapping() makes it take the
>> mapped-folio path after the swapcache reference has been dropped. This can
>> cause an invalid swap_space lock access followed by a folio reference
>> count BUG.
>>
>> Refresh the saved mapping after folio_free_swap() so the current folio
>> state is used during migration.
>>
> 
> Thanks.  AI review might have found an issue with this.  And one
> possible pre-existing issue in the code which Alistair and Balbir
> worked on.
> 
> 	https://sashiko.dev/#/patchset/20260724082702.2531024-1-arvind.yadav@xxxxxxxxx

Yeah, this might need another careful look.

-- 
Cheers,

David